Your assuming that the person interviewing him knew what the answer was supposed to be. It sounds like the incompetence goes all the way up and he was probably hired by a businessman who had no idea what PCI even is, much less the details of proper security.
